Remote Desktop UAF漏洞蓝屏，SQL Server 报偏移量为???的位置执行 读取 期间，操作系统已经向 SQL Server 返回了错误 21

蓝屏转储 memory.dmp， 不及格的程序员-八神， 每次SqlServer数据库不可用时，在相近时间点上能看到系统蓝屏的系统日志，猜测与蓝屏重启有关。

3: kd> !analyze -v termdd
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88002e67006, address which referenced memory

STACK_TEXT:  
fffff880`088c9a88 fffff800`016bcf69     : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`088c9a90 fffff800`016bad88     : 00000000`00000000 00000000`00000000 fffffa80`06cdc900 fffffa80`08abfd60 : nt!KiBugCheckDispatch+0x69
fffff880`088c9bd0 fffff880`02e67006     : fffffa80`08abfd60 fffffa80`08abfd60 fffffa80`08ada010 fffff880`088c9df0 : nt!KiPageFault+0x448
fffff880`088c9d60 fffff880`02e66e01     : fffffa80`08a74940 fffffa80`08046100 fffff8a0`003ab000 fffff880`088c9fa0 : termdd!IcaChannelInputInternal+0x1f2
fffff880`088c9e40 fffff880`0466f198     : fffff8a0`035de010 fffff880`02e6bd6c fffffa80`076f1740 fffffa80`0938b730 : termdd!IcaChannelInput+0xdd
fffff880`088c9e80 fffff880`0464c708     : 00000000`00000000 fffff800`00000001 00000000`00000000 00000000`00000000 : RDPWD!SignalBrokenConnection+0x54
fffff880`088c9ee0 fffff880`02e66d8f     : fffffa80`08a74940 fffffa80`076f1a20 fffffa80`076f1740 00000000`c000013c : RDPWD!WDLIB_MCSIcaChannelInput+0x90
fffff880`088c9f30 fffff880`046306a4     : fffffa80`076f1a20 fffffa80`076f1a20 fffffa80`076f1740 fffffa80`076f1a20 : termdd!IcaChannelInput+0x6b
fffff880`088c9f70 fffff880`02e6af3e     : fffffa80`07430720 fffffa80`0933bf20 fffffa80`08c8f010 fffffa80`08368750 : tdtcp!TdInputThread+0x64c
fffff880`088ca7f0 fffff880`02e69ae3     : fffffa80`08552cb0 fffffa80`08368750 fffffa80`07189d80 fffffa80`08c8f010 : termdd!IcaDriverThread+0x5a
fffff880`088ca820 fffff880`02e689e9     : fffffa80`088dd420 fffff880`088ca958 fffff880`088ca960 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
fffff880`088ca900 fffff880`02e68689     : 00000000`00000000 fffffa80`08368750 00000000`00000000 fffffa80`088dd538 : termdd!IcaDeviceControl+0x75
fffff880`088ca950 fffff800`0190dd9a     : 00000000`00000002 00000000`00000002 00000000`00000000 fffffa80`08c80660 : termdd!IcaDispatch+0x215
fffff880`088ca990 fffff800`01ad3831     : fffffa80`08c80660 fffffa80`08c80660 fffffa80`08c80660 fffff880`01efa180 : nt!IopSynchronousServiceTail+0xfa
fffff880`088caa00 fffff800`019655d6     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xc51
fffff880`088cab40 fffff800`016bcbd3     : 00000000`80000001 fffff800`01ab3b46 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`088cabb0 00000000`77a898fa     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01eff818 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a898fa

SYMBOL_NAME:  termdd!IcaChannelInputInternal+1f2

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0xD1_termdd!IcaChannelInputInternal+1f2

OS_VERSION:  7.1.7601.24384

BUILDLAB_STR:  win7sp1_ldr_escrow

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

 系统日志与应用日志报告：不及格的程序员-八神

 之前也出现的，3-15日